GitPython EUVD-2026-101741

Exploitation requires that the calling application pass attacker-controlled data as the POSITIONAL refspec argument to GitPython's Remote.pull(); the flaw's unsafe-option guard validates only keyword arguments, so a positional '--upload-pack=<command>' slips through. The affected transports are local-path and SSH remotes, and the affected version range is GitPython 3.1.30 up to (but not including) 3.2.0 - installations on 3.2.0+ or before 3.1.30 are not vulnerable. The principal LIMITING factor is the data path: if the application never exposes the refspec to untrusted input (hardcoded or server-controlled refspecs), the vulnerability is not reachable despite PR:N/UI:N. Commands execute with the privileges of the Python process invoking GitPython, so process sandboxing/least-privilege further bounds impact.

This is a genuine high-priority issue rather than a CVSS-inflated one, but with an important caveat about exploitability conditions. The CVSS 4.0 vector (AV:N, AC:L, PR:N, UI:N, VC:H/VI:H/VA:H) and 9.2 score reflect that successful exploitation yields full OS command execution as the calling process with no authentication and no user interaction. Critically, however, the vector carries AT:P (attack requirements present), which aligns with the description: the attacker does not attack GitPython directly but must control the positional refspec passed into Remote.pull() by a host application - so real-world risk is bounded by whether a deployed application forwards untrusted input into that argument. No EPSS score was provided and the CVE is NOT listed in CISA KEV; no POC was supplied in the intelligence, so exploitation status is no public exploit identified at time of analysis. CWE-88 (argument injection) and the --upload-pack=<command> technique are well-understood classes with trivially reproducible exploitation once the data path exists, so the gap between 'no POC seen' and 'weaponizable' is small. Net: treat as urgent for any application that passes user-controllable refspecs to GitPython, but note the AT:P prerequisite distinguishes this from a wormable, zero-condition RCE.

An application uses GitPython's Remote.pull() and passes a user-supplied value as the refspec (e.g., a web service that lets users specify a branch/ref to synchronize). An attacker submits a refspec of '--upload-pack=touch /tmp/pwned;' (or a reverse-shell command); because the unsafe-option guard only inspects keyword arguments, the malicious positional option reaches the underlying git invocation over a local-path or SSH transport and executes as the service process. No authentication to GitPython and no user interaction are required once attacker input reaches the refspec; no public POC was provided in the intelligence.